Hacker News Reader

Keep in mind that developers hear a user needs to be notified in “the most expedient time possible” and think minutes or hours but the lawyers read that and are thinking days or potentially even weeks in some circumstances. Just because Instacart hasn’t notified anyone yet doesn’t mean they won’t or that they’ve failed to comply with the obligation.

View on HN

Then the law sounds ineffective to me. There are security researchers featured in this article saying that this dump looks legit, and Instacart still gets to pretend like everything is normal? User data could wind up sitting on the dark web for weeks before Instacart finally gets around to notifying them of the breach.

Tools like haveibeenpwned typically rely on companies' cooperation to report breaches since "data breach" is a legal term. But since Instacart still hasn't reported this, do the security tools get updated in a timely way, or are there millions of credit cards and passwords sitting up for sale while lawyers figure out how to handle the legal side of this?

it's almost as if the law was specifically written this way to sound useful, but is actually toothless

Reply on news.ycombinator.com